Send documentation comments to mdsfeedback-doc@cisco.com
17-7
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 17 Troubleshooting RADIUS and TACACS+
AAA Issues
Verifying TACACS+ Server Monitor Configuration Using Fabric Manager
To verify or change the TACACS+ server monitor configuration using Fabric Manager, follow these
steps:
Step 1 Choose Switches > Security > AAA > TACACS+ and select the Servers tab. You see the TACACS+
configuration in the Information panel.
Step 2 Highlight the server that you need to change and click Delete Row to delete this server configuration.
Step 3 Click Create Row to add a new TACACS+ server.
Step 4 Set the KeyType and Key fields to the preshared key configured on the TACACS+ server.
Step 5 Set the AuthPort and AcctPort fields to the authentication and accounting ports configured on the
TACACS+ server.
Step 6 Set the Idle Time field to configure the time that the switch waits for a TACACS+ server to be idle before
sending a test message to see if the server is still alive.
Step 7 Set the TimeOut value and click Apply to save these changes.
Step 8 Select the CFS tab and select commit from the Config Action drop-down menu and click Apply
Changes to distribute these changes to all switches in the fabric.
Step 9 Choose Switches > Security > AAA and click Create Row to create a server group.
Step 10 Check the list of switches that you want to configure server groups on.
Step 11 Set the Server List field to a comma-separated list of TACACS+ servers.
Step 12 Set the Deadtime field to configure the time that the switch waits before retesting a dead server. and click
Apply to save these changes.
Verifying TACACS+ Server Monitor Configuration Using the CLI
To verify or change the TACACS+ server monitor configuration using the CLI, follow these steps:
Step 1 Use the show running-config command to view the TACACS+ configuration for the server monitor.
switch# show running-config | begin tacacs
tacacs-server deadtime 40
tacacs-server host 11.6.5.4 key 7 “VagwwtFjq”
tacacs-server host 11.6.5.4 test idle-time 30
Step 2 Use the tacacs-server host ip address test idle-time command to configure the time that the switch
waits for a TACACS+ server to be idle before sending a test message to see if the server is still alive.
Step 3 Use the tacacs-server deadtime command to configure the time that the switch waits before retesting a
dead server.
Step 4 Use the tacacs commit command to commit any changes and distribute to all switches in the fabric.
To Next Page
Loading...
Need help?
General